Examkin

Question

Difficulty: Very hardDeploying and Managing Compute Engine Virtual Machines

An enterprise security architecture team requires all Compute Engine VM instances provisioned for a mission-critical web backend to use fine-grained IAM authorization. The instances must run under a custom IAM service account named `[email protected]` with restricted Cloud Pub/Sub permissions, and they must automatically run a bootstrapping script located at a private Cloud Storage path (`gs://config-bucket-prod/startup.sh`) during initialization. Which `gcloud` CLI command correctly creates an instance template meeting these security and operational requirements?

  1. gcloud compute instance-templates create backend-template --service-account=backend-service-sa@prod-proj.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platform --metadata=startup-script-url=gs://config-bucket-prod/startup.shAnswer
  2. B
    gcloud compute instance-templates create backend-template --service-account=backend-service-sa@prod-proj.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/pubsub --metadata=startup-script=gs://config-bucket-prod/startup.sh
  3. C
    gcloud compute instance-templates create backend-template --scopes=https://www.googleapis.com/auth/pubsub --metadata=startup-script-url=gs://config-bucket-prod/startup.sh
  4. D
    gcloud compute instance-templates create backend-template --service-account=backend-service-sa@prod-proj.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platform --metadata=startup-script-url=gs://config-bucket-prod/startup.sh --provisioning-model=SPOT --instance-termination-action=DELETE

Answer

The command specifying `--service-account=backend-service-sa@prod-proj.iam.gserviceaccount.com`, `--scopes=https://www.googleapis.com/auth/cloud-platform`, and `--metadata=startup-script-url=gs://config-bucket-prod/startup.sh` correctly provisions the instance template according to Google Cloud security and CLI best practices.
The command configuring `--service-account` with the custom identity, setting the scope to `cloud-platform`, and defining `--metadata=startup-script-url=gs://...` follows all Google Cloud recommended practices. Setting the access scope to `cloud-platform` allows IAM roles attached to the custom service account to grant fine-grained permissions without being restricted by legacy OAuth access scope boundaries, while `startup-script-url` ensures Compute Engine correctly fetches the initialization script from Cloud Storage.

Step-by-Step Solution

1
Identify the service account configuration requirement
Using `--service-account` attaches the custom IAM service account to enforce least privilege, paired with the standard `https://www.googleapis.com/auth/cloud-platform` scope so IAM permissions dictate actual API access.
Relying on the default Compute Engine service account grants overly broad Editor roles, while scoping to `cloud-platform` delegates all authorization decisions to IAM policies on the custom service account.
2
Identify the correct metadata key for remote startup scripts
The `startup-script-url` metadata key must be used when referencing a Cloud Storage bucket location (`gs://...`).
The standard `startup-script` key is designated for direct inline bash scripts, whereas `startup-script-url` fetches and executes scripts stored in remote Cloud Storage buckets.
3
Evaluate workload suitability for VM provisioning models
Standard provisioning must be used rather than Spot/Preemptible VMs.
Mission-critical web application backends require uninterrupted availability, making Spot VMs (which can be terminated by Compute Engine at any time) inappropriate.

Key Concept

Configuring Compute Engine Instance Templates with custom IAM Service Accounts and Startup Script URIs via gcloud CLI
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic